As a last resort, a Starfleet captain can order his ship to destroy itself in a massive explosion.

Starfleet has learned through bitter experience that it may be necessary to destroy its ships to prevent them
falling into enemy hands or as a last resort in other dire situations.

Galaxy-class ships have two independent autodestruct systems that
ensure the vessel can be completely destroyed even if the saucer has been separated; autonomous subprocessor
nodes located around the vessel ensure that the autodestruct sequence can still be activated and carried out in
a situation where the main computer has been disabled. The primary autodestruct system is designed to vaporize
the ship with an enormous matter-antimatter explosion, which is created by initiating a controlled release of
the warp engine reactant materials. This produces a massive mechanical and thermal shock that destroys the
ship rapidly and completely.

When the autodestruct sequence enters the final phase, the computer generates a deliberate cascade failure in
which all the warp engine safety interlocks are compromised. All the antimatter in the storage pods on deck 42,
and the matter in the primary deuterium tanks is released simultaneously. This generates an explosion that is
roughly equivalent to the explosive force of 1,000 photon torpedoes. The amount of energy released is in the
region of 1,015 megajoules. This is significantly greater than the amount of energy normally released as the
result of the antimatter containment loss, and it ensures that the ship and any valuable technology aboard the
vessel are completely eliminated. If the computer cannot send the necessary instructions to the engineering
system, the ship is equipped with a backup autodestruct system. This secondary system is somewhat more primative.
Ordnance packages are fitted to various locations, including the antimatter storage pods. If necessary, they
can be detonated, releasing the antimatter. At the same time, the secondary system can deliberately overload
the fusion reaction chamber. This will generate an explosion equivalent to that of 500 photon torpedoes,
approximately 109 megajoules. Although this is only half as powerful as the primary autodestruct system, it is
more than enough to vaporize the ship.

Because the primary autodestruct sequence uses the antimatter storage tanks in the engineering hull, it cannot
be used to destroy the saucer section when the ship is in separated flight mode. However, the secondary system
is sufficient to destroy the saucer on its own, and this becomes the saucer's primary autodestruct system when
the two parts of the ship are not joined.

In combat it is normally only deemed necessary to destroy the ship when all propulsion and weapons systems have
been disabled and there is little or no prospect of assistance from other Federation vessels. Computer models
have also shown that it may be necessary to destroy the ship if navigational control has been lost and it is on
a collision course with a populated area. Ultimately, the decision to activate the autodestruct systems rests
with the ship's commanding officers. The autodestruct sequence requires authorization by at least two
command-level officers. If the captain and first-officer are dead or disabled, the computer will automatically
look for the next highest ranked officer; however, it will not accept an autodestruct order from an officer
below the position of operations manager. To activate the sequence, the two most senior command officers
instruct the computer to begin the autodestruct procedure, and then confirm their identities with a dermal
imprint or by giving their personal access codes. Once the computer has verified their authority, the senior
officers give the command to set the autodestruct sequence. The computer asks the other officer if he or she
agrees, and, if they do, the senior officer sets the duration of the countdown until the system is activated.
The computer informs the crew of the time remaining until the ship is destroyed by making repeated audio
announcements and producing graphics on displays throughout the vessel. The two initiators of the autodestruct
procedure can order a silent countdown if so desired.

The autodestruct sequence can be aborted at any time before the countdown reaches zero and the ship is actually
destroyed. But the abort order requires both officers who initiated the autodestruct to be in agreement.